Opinion
C24-0316JLR
09-03-2024
MEREDITH BEAGLE, et al., Plaintiffs, v. AMAZON.COM, INC. et al., Defendants.
ORDER
JAMES L. ROBART United States District Judge
I. INTRODUCTION
Before the court is Defendants Amazon.com, Inc. and Amazon.com Services LLC's (individually, “Amazon Services,” and together with Amazon.com, Inc., “Amazon”) motion to dismiss for failure to state a claim. (Mot. (Dkt. # 34); Reply (Dkt. # 39).) Plaintiffs Meredith Beagle, Jordan Guerrero, and Sofauna Johnson (collectively, “Plaintiffs”) oppose Amazon's motion to dismiss. (Resp. (Dkt. # 37).) The court has considered the parties' submissions, the relevant portions of the record, and the applicable law. Being fully advised,the court GRANTS Amazon's motion to dismiss.
Both parties request oral argument (MTD at 1; MTD Resp. at 1), but the court concludes that oral argument would not aid in its disposition of Amazon's motion, see Local Rules W.D. Wash. LCR 7(b)(4). Amazon also asks the court to take judicial notice of 12 exhibits (see generally Request (Dkt. # 36); Request Reply (Dkt. # 41); 6/24/24 Goldmark Decl. (Dkt. # 35); 8/7/24 Goldmark Decl. (Dkt. # 40)), but the court concludes that judicial notice of these documents is unnecessary to its analysis. Plaintiffs also filed a notice of supplemental authority, informing the court of the Ninth Circuit's decision in Calhoun v. Google, LLC, ---F.4th ---, 2024 WL 3869446 (9th Cir. 2024). (Not. (Dkt. # 42).) After reviewing Calhoun, the court determines that it is not relevant to its analysis of Amazon's motion.
II. BACKGROUND
This case arises out of Amazon Services's alleged disclosure of Plaintiffs' personally identifiable information (“PII”) to other Amazon affiliates and third parties. (See generally Am. Compl. (Dkt. # 33).) Plaintiffs compare Amazon to “Big Brother” and seek to vindicate Amazon users' privacy rights through this action. (Id. ¶¶ 3-4.) In particular, Plaintiffs allege that “Amazon Services maintains a virtual ‘warehouse' of data that it collects from [users of Amazon Prime Video] who are unable to opt-out” and gives access to that information to Amazon.com, Inc. and “non-Amazon affiliated third parties” for purposes such as advertising and audience measurement. (Id. ¶¶ 17-18, 25.) Plaintiffs allege that Amazon “burie[s]” these practices in lengthy privacy notices and terms of use. (E.g., id. ¶¶ 56-68; id. ¶ 48 (alleging that “[t]he ‘disclosures' acknowledge that Amazon Services can and is sharing PII-related video usage history with both Amazon affiliates and unaffiliated third parties”).) Plaintiffs believe that Amazon's alleged disclosure of PII in this manner violates the federal Video Privacy Protection Act (“VPPA”), California Civil Code § 1799.3 (“section 1799.3”), and the Washington Consumer Protection Act (“CPA”). (Id. ¶¶ 135-163.) Plaintiffs seek to represent a class comprising “[a]ll persons nationwide who have rented, purchased, or streamed audiovisual content from Amazon Prime within the applicable statute of limitations and as permitted by applicable tolling periods.” (Id. ¶ 125.) Ms. Johnson seeks to represent a sub-class comprising “[a]ll persons in the State of California who have Prime Video and amazon.com accounts, and viewed videos on Prime Video.” (Id. ¶ 126.)
Defendants move to dismiss Plaintiffs' claims under Federal Rule of Civil Procedure 12(b)(6). (See generally Mot.) Plaintiffs oppose Amazon's motion and also seek leave to add a claim for invasion of privacy. (See generally Resp.) Amazon's motion is now ripe for review.
III. ANALYSIS
The court sets forth the relevant legal standard before turning to Amazon's motion to dismiss.
A. Rule 12(b)(6) Legal Standard
Federal Rule of Civil Procedure 12(b)(6) provides for dismissal of a complaint upon the plaintiff's “failure to state a claim upon which relief can be granted.” Fed.R.Civ.P. 12(b)(6). A Rule 12(b)(6) dismissal may “be based on the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory.” Balistreri v. Pacifica Police Dep't, 901 F.2d 696, 699 (9th Cir. 1988). A plaintiff's complaint must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Although the pleading standard announced by Federal Rule of Civil Procedure 8 does not require “detailed factual allegations,” it demands more than “an unadorned, the-defendant-unlawfully-harmed-me accusation.” Id. (requiring the plaintiff to “plead[ ] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged” (citing Twombly, 550 U.S. at 556, 127 S.Ct. 1955)); see also Fed.R.Civ.P. 8(a)(2). “The plausibility standard is not akin to a ‘probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully. Where a complaint pleads facts that are ‘merely consistent with' a defendant's liability, it ‘stops short of the line between possibility and plausibility of ‘entitlement to relief.'” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 557).
When considering a Rule 12(b)(6) motion, the court takes the well-pleaded factual allegations as true and views such allegations in the light most favorable to the plaintiff. Wyler Summit P'ship v. Turner Broad. Sys., Inc., 135 F.3d 658, 661 (9th Cir. 1998). The court need not, however, accept as true a legal conclusion presented as a factual allegation, Iqbal, 556 U.S. at 678, nor is the court required to accept as true “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences,” Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001).
B. Amazon's Motion to Dismiss
Amazon argues that Plaintiffs fail to state a claim for violations of the VPPA, section 1799.3, or the CPA. The court considers Plaintiffs' claims under the VPPA and section 1799.3 together before turning to Plaintiffs' claim under the CPA and request to add a claim for invasion of privacy.
i. VPPA and Section 1799.3
The VPPA and section 1799.3 make it unlawful for certain video service providers to “disclose[]” a customer's personal information to another person. See 18 U.S.C. § 2710(b)(1); Cal. Civ. Code § 1799.3(a). Both statutes have numerous exceptions, including disclosures that are “incident to the ordinary course of business,” 18 U.S.C. § 2710(b)(2)(E), and disclosures made with the customer's “written consent,” Cal. Civ. Code § 1799.3(a). Amazon argues that Plaintiffs have failed to state a claim under either statute because they do not plausibly allege that Amazon Services actually disclosed any of their PII to Amazon affiliates or third parties. (See Mot. at 9-19.) The court agrees.
Because the court agrees with Amazon that Plaintiffs have failed to allege any unlawful disclosures of their information, the court does not consider whether Amazon's hypothetical disclosure of said information would be authorized under an exception in the VPPA or section 1799.3. (See Mot. at 11 (arguing that “any alleged disclosure to Amazon affiliates falls within the VPPA's ordinary course of business exception” (capitalization altered)); id. at 19 (arguing that Ms. Johnson “provided written consent under § 1799.3”).)
First, with respect to Amazon Services's alleged disclosures to other Amazon affiliates, Amazon is correct that Plaintiffs allege, at most, the mere possibility that information could be disclosed to those affiliates, rather than that Amazon Services had in fact made such disclosures. (Id. at 9.) Plaintiffs allege that “Amazon Services maintains a virtual ‘warehouse' of data that it collects from consumers . . . and gives Amazon[.com,] Inc. access to that database.” (Am. Compl. ¶ 18 (emphasis added).) For each of the named Plaintiffs, Amazon alleges that “Amazon Services . . . disclosed [their] information to Amazon[.com,] Inc. by providing Amazon[.com,] Inc. with direct access to Amazon Services'[s] database with information on [them].” (Id. ¶¶ 103, 112, 121 (emphasis added).) Although the act of disclosure suggests access, however, the opposite is not true. That Amazon Services allegedly provides access to Plaintiffs' PII does not plausibly suggest that Amazon Services has taken the affirmative act of disclosing that data to Amazon.com, Inc. or that Amazon.com, Inc. has actually received that data. See Iqbal, 556 U.S. at 678 (“Where a complaint pleads facts that are ‘merely consistent with' a defendant's liability, it ‘stops short of the line between possibility and plausibility[.]'” (quoting Twombly, 550 U.S. at 557)).
Plaintiffs' cited cases are distinguishable because, in both cases, the defendant automatically sent the users' PII to third parties. In In re Hulu Privacy Litigation, Hulu had written a code that “automatically” transmitted users' PII to Facebook. No. C11-03764 LB, 2014 WL 1724344, at *13, *16 (N.D. Cal. Apr. 28, 2014). Similarly, in Czarnionka v. Epoch Times Association, Inc., the plaintiff alleged that “a string of code” would “send[] Facebook information about the subscriber” to the defendant “[w]hen a subscriber views a video on Defendant's website.” No. 22 Civ. 6348 (AKH), 2022 WL 17069810, at *1 (S.D.N.Y. Nov. 17, 2022). Plaintiffs make no allegations in their complaint of automatic disclosures from Amazon Services to Amazon.com, Inc. (See generally Am. Compl.) This case is more akin to Rodriguez v. Sony Computer Entertainment America LLC, in which the “plaintiff's allegations fail[ed] to state that a disclosure ha[d] affirmatively taken place,” No. C 11-4084 PJH, 2012 WL 12921066, at *1 (N.D. Cal. Apr. 20, 2012) (emphasis added), and Mendoza v. Microsoft Inc., in which the plaintiffs' complaint failed to explain “how the disclosures happened, to whom the information was disclosed/sold, or even that Plaintiffs' own information was disclosed,” No. C14-0316MJP, 2014 WL 4540213, at *1 (W.D. Wash. Sept. 11, 2014) (emphasis added).
Second, the court agrees with Amazon that Plaintiffs do not plausibly allege that Amazon Services disclosed their PII to any unaffiliated third parties. (Mot. at 14. See generally Am. Compl.) Instead, Plaintiffs surmise that because Amazon's Prime Video Terms of Use state that Amazon Services “may provide information about your viewing behavior to third parties,” Amazon Services must have disclosed Plaintiffs' PII to third parties. (See Am. Compl. ¶¶ 76-80; see also Resp. at 14 (stating that there is an “inference that the data is actually being disclosed” to third parties).) Although Plaintiffs' allegations are again consistent with Amazon's liability, they still fail to state a claim that is plausible and not merely possible.
Because Plaintiffs do not plausibly allege that Amazon Services disclosed their PII to Amazon affiliates or third parties, they have failed to plead an essential element of a claim under the VPPA or section 1799.3. The court therefore grants Amazon's motion to dismiss these claims. Because it cannot conclude at this time that amendment would be futile, the court grants Plaintiffs leave to amend these claims.
ii. CPA
Amazon argues that the court should also dismiss Plaintiffs' CPA claim for two reasons: (1) Plaintiffs fail to allege any “unfair” or “deceptive” acts; and (2) Plaintiffs fail to allege a cognizable injury to their business or property. (Mot. at 22-24.) Plaintiffs do not argue that Amazon engaged in any “deceptive” acts and “concede that they have not alleged an injury under the []CPA.” (Resp. at 24-25.) Nevertheless, Plaintiffs argue that Amazon engaged in “unfair” practices by (1) disclosing Plaintiffs' PII in violation of the VPPA and section 1799.3 and (2) misleading Plaintiffs about the information being collected, failing to provide an opt-out mechanism, and failing to timely destroy records. (Id.) Plaintiffs also “request leave to amend to add allegations regarding the lost value of their PII and time or expenses incurred mitigating the disclosure of their PII.” (Id. at 25.) The court dismisses Plaintiffs' CPA claim without leave to amend.
“[T]o prevail in a private CPA action . . . a plaintiff must establish five distinct elements: (1) [an] unfair or deceptive act or practice; (2) occurring in trade or commerce; (3) public interest impact; (4) injury to plaintiff in his or her business or property; [and] (5) causation.” Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 719 P.2d 531, 533 (Wash. 1986).
First, Plaintiffs cannot plead an unfair act under the CPA. An “unfair act” under the CPA is one that “(1) causes or is likely to cause substantial injury, which (2) consumers cannot avoid, and (3) is not ‘outweighed by countervailing benefits.'” Merriman v. Am. Guarantee & Liab. Ins. Co., 396 P.3d 351, 628 (Wash.Ct.App. 2017) (quoting Klem v. Wash. Mut. Bank, 295 P.3d 1179, 1187 (Wash. 2013)). As discussed above, Plaintiffs have failed to allege that Amazon disclosed their PII in violation of the VPPA or section 1799.3. Even if Plaintiffs had alleged that disclosure of their PII caused or is likely to cause them substantial injury however, that injury would have been avoidable. Plaintiffs allege that the relevant terms and conditions disclose these exact data practices. (See Am. Compl. ¶ 48 (“The ‘disclosures' acknowledge that Amazon Services can and is sharing PII-related video usage history with both Amazon affiliates and unaffiliated third parties[.]”).) As a result, all Plaintiffs had to do to avoid the alleged injury was read the terms and conditions and choose not to use Amazon's services. See Gray v. Amazon.com, Inc., 653 F.Supp.3d 847, 859 (W.D. Wash. 2023) (“In light of Amazon's disclosures, consumers would have ‘reason to anticipate' their injury and ‘the means to avoid it'-i.e., by reviewing the Alexa Terms and decline to purchase and use an Alexa-enabled device.”).
Second, Plaintiffs cannot plead an injury to their business or property that is cognizable under the CPA. At most, Plaintiffs allege that Amazon invaded their privacy, which is “a ‘personal' injury, rather than a ‘business or property' injury.” Gragg v. Orange Cab Co., 942 F.Supp.2d 1111, 1118-19 (W.D. Wash. 2013) (“Plaintiff cites no Washington law that establishes that an invasion of privacy is a cognizable injury under the CPA, and the Court has not found any such authority.”). Plaintiffs' cited cases are distinguishable because they involved victims of data breaches. In Krefting v. Kaye-Smith Enterprises Inc., the plaintiff “discovered a credit account fraudulently opened using his personal information.” No. C23-0220JNW, 2023 WL 4846850, at *3, (W.D. Wash. July 28, 2023). In Guy v. Convergent Outsourcing, Inc., the Plaintiffs alleged that their information was “now available for sale on the ‘Dark Web,'” and one plaintiff in particular experienced “many spam phone calls and emails daily after the data breach, but not before.” No. C22-1558MJP, 2023 WL 4637318 (W.D. Wash. July 20, 2023). As Plaintiffs' complaint makes clear, this is a case about Amazon's alleged disclosure of information to Amazon affiliates and third parties, not Amazon's failure to protect Plaintiffs' information from hackers. (See Am. Compl. ¶ 5.) Plaintiffs do not, and cannot, allege that they are the victims of an unfair act or suffered a cognizable injury under the CPA. The court therefore dismisses this claim with prejudice.
iii. Invasion of Privacy
Plaintiffs ask the court to grant them leave to add a claim for invasion of privacy if it denies them leave to amend their CPA claim. (Resp. at 25.) The court denies Plaintiffs' request because such a claim would be futile.
“One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his privacy, if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.” Emeson v. Dep't of Corr., 376 P.3d 430, 442 (Wash.Ct.App. 2016) (quoting Restatement (Second) of Torts § 652D)). “[P]ublicity ‘means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.'” Id. (quoting Restatement (Second) of Torts § 652D cmt. a).
This is not a case about Amazon's disclosure of Plaintiffs' PII to the public at large. To the contrary-and as noted above-it is a case about Amazon's alleged disclosures of PII within the Amazon ecosystem and to certain third parties to communicate with Amazon users about promotional offers and target them with ads. (See Am. Compl. ¶ 69); see also Nienaber v. Overlake Hosp. Med. Ctr., No. C23-1159TL, 2024 WL 2133709, at *10 (W.D. Wash. May 13, 2024) (“Plaintiff does not allege that the information shared by Defendant will become available to the public at large; to the contrary, Plaintiff alleges that the information is shared with Facebook and, in turn, is being used by Facebook to target Plaintiff herself.”). The court therefore denies Plaintiffs' request for leave to add an invasion of privacy claim.
IV. CONCLUSION
For the foregoing reasons, the court GRANTS Amazon's motion to dismiss (Dkt. # 34). The court DISMISSES Plaintiffs' claims under the VPPA and section 1799.3 without prejudice and with leave to amend. The court DISMISSES Plaintiffs' claim under the CPA with prejudice and without leave to amend. The court DENIES Plaintiffs' request for leave to add a claim for invasion of privacy under Washington law. Plaintiffs shall file their amended complaint by no later than September 20, 2024. If Plaintiffs fail to file an amended complaint by that date, the court will dismiss all of their claims and this action with prejudice.